In the Linux kernel ALSA aoa subsystem, the function snd_ctl_new1() can return NULL when memory allocation fails. The code in layout.c does not validate this return value before accessing ctl->id.name or calling aoa_snd_ctl_add(), resulting in a NULL pointer dereference that crashes the kernel. The crash restores the system to a non‑functional state, providing only a denial‑of‑service through a kernel panic or reboot.

All Linux kernel implementations that include the ALSA aoa driver are affected. No specific version range is supplied in the advisory; the flaw exists in any kernel release that has the unpatched layout.c code.

The CVSS score is 5.5, but the EPSS score is reported as < 1% and the flaw is not listed in CISA’s KEV catalog, indicating a low but non‑zero likelihood of exploitation. Because the vulnerability requires the ALSA aoa module to be loaded and a memory allocation failure to occur, the attack vector is likely local or requires an attacker to induce a low‑memory condition. The resulting kernel panic brings the system offline, but does not allow privilege escalation or data exfiltration. The overall risk is moderate, yet the severity of the crash warrants timely patching.